Access the lab

1. owasp 2013 → A1 INJECTION (SQL) → SQLi- Bypass Authentication → LOGIN
   

2. do intercept on in burp suite and enter username : admin ; password : anything ( i entered cat)
   

3. go to proxy in burp suite and send to intruder
   

4. go to intruder → first clear → then choose the attack type as → cluster bomb

• if two files (notepad files ) you need to parse you need to give PITCHFORK
  

5. then select the password and click on ADD, then the username and click on ADD
   

6. then select payload test as 1 and enter 5 datas: admin , deeps, pinky, rinky ,root { admin 's password is admin }
   

7. then select payload test as 2 and enter 5 datas: admin , deeps ,cat, dog, test

8. After filling all the 5 datas: then run attack (we are using brute force attack here)
   

9. then when the status code is 302 that means it is the original password ,else it is wrong password.
   

10. then click on the admin and send to repeater
    

11. then go to repeater and send
    

12. then next click on follow direction
    

13. then go to render and you see status update : user authenticated.
    

14. then click on the WordPress
    

15. then click on login.
    

16. then enter the username and the password here it shows that the username is wrong with this password.